DocumentationOverview
About vulnerability
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider’s OIDC issuer or SAML entity ID and assert a victim’s subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.Details
- Affected product:
- better-auth , better-auth-api-key , better-auth-cimd , better-auth-cli , better-auth-electron , better-auth-expo , better-auth-i18n , better-auth-mcp , better-auth-oauth-provider , better-auth-passkey , better-auth-redis-storage , better-auth-scim , better-auth-sso , better-auth-stripe , better-auth-test-utils
- Affected packages:
- better-auth @ 1.7.2 (+28 more)